Fix eventual memory overrun
* mail/mail.c (mail_mainloop): Check command length before trying to access its last byte.
Showing
1 changed file
with
1 additions
and
1 deletions
... | @@ -558,7 +558,7 @@ mail_mainloop (char *(*input) (void *, int), | ... | @@ -558,7 +558,7 @@ mail_mainloop (char *(*input) (void *, int), |
558 | while ((command = (*input) (closure, 0)) != NULL) | 558 | while ((command = (*input) (closure, 0)) != NULL) |
559 | { | 559 | { |
560 | int len = strlen (command); | 560 | int len = strlen (command); |
561 | while (command[len-1] == '\\') | 561 | while (len > 0 && command[len-1] == '\\') |
562 | { | 562 | { |
563 | char *buf; | 563 | char *buf; |
564 | char *command2 = (*input) (closure, 1); | 564 | char *command2 = (*input) (closure, 1); | ... | ... |
-
Please register or sign in to post a comment